On 24 June, the government decree containing the IT requirements of the Cybersecurity Certification and Cybersecurity Supervision Act entered into force. The promulgation of the implementing decree for the Act on cybersecurity certification and cybersecurity supervision (CyberCert Act) is a significant step for companies, prospective auditors and consultants alike.

 The 120-page document contains the precise requirements to start the preparation of the companies concerned and to plan their official cybersecurity audits starting in 2025.

Rules for a wide target group

The government decree provides a common list of requirements that should be applicable to all companies covered by the CyberCert Act, covering nearly 100 sectors of activity. This has resulted in a rather long, general but sufficiently detailed document.

The NIS2 applies to all companies that

• employs more 50 persons, or
• has an annual turnover of more than EUR 10 million, and
• operates in one of the sectors considered critical from a strategical point of view.

Preliminary estimates suggest that around 2,500-3,000 businesses in Hungary could be directly impacted, with the potential for several times that number to be indirectly affected by this new provision.

The three chapters in the package

The decree sets out a risk management framework, a catalogue of measures and a catalogue of threats, which are to be implemented and applied by the companies affected by the legislation.

The risk management chapter contains the basic steps necessary to classify information systems and to monitor the implementation of the associated security measures. This chapter therefore means the regulation of the foundational measures. For companies that have not yet addressed information security risk management in depth, the chapter can also be seen as a form of help with that.

The risk management process will result in an inventory of the information systems used by the company and all the systems included will be classified in one of the security classes (basic, significant, high) set out in the decree. These three classes and the risk management framework itself in the decree have a number of similarities with existing international risk management standards, which will help to facilitate the transition between them.

A staggering number of security measures required

The classification will be used as the basis for the security measures to be introduced for systems, which will also be sought and tested in the mandatory audits. This includes more than 160 for the “basic”, more than 300 for the “significant,” and nearly 400 mandatory inspection and control points, as well as associated measures for the “high” security class. By comparison, the latest version of ISO 27001 Information Security Standard from 2022 only contains 93 control points.

In addition, some 530 additional security measures are also included in the decree, the use of which is not generally mandatory, but which companies may consider incorporating into their information security management systems, depending on their sector and activities.

To improve transparency, the security measures are grouped into 19 categories, such as: access control, training, systems monitoring, business continuity, incident management, supply chain security, etc.

For each category, the legislation not only requires adequate documentation and clear responsibilities of the companies concerned, but also organisational measures and adequate technological readiness in order to successfully pass the audits.

Mandatory but interchangeable

With specific cases in mind, the decree allows companies to derogate in certain cases from the rules set out in the catalogue of security measures issued. This may be the case, for example, where the technology used, the operating environment, the physical infrastructure or a public service does not allow certain measures to be put in place.

In special cases, the company may use its own substitute security measures, but in this case it must also document how the arrangements it uses are better than those in the decree. In addition, the company must ensure that the documentation is regularly reviewed, as circumstances may change over time. Substitute measures may only be implemented by companies at their own discretion and with written approval from the responsible manager.

Compliance can be painful

The promulgated decree also highlights that a significant proportion of companies covered by NIS2 will face serious challenges in complying with the legislation. For them, putting in place the mandatory security measures will require significant resources and, most importantly, considerable time, so it is advisable to start preparing as soon as possible in order to pass the first regulatory audit in 2025.